A project places highly sensitive processing in a broadly trusted network zone. What should a security architecture review focus on?

1. Only the number of routers
2. Only the server purchase date
3. An assumption that internal traffic is always authorized
4. Appropriate trust boundaries and least-privilege communication paths